Zyxel Fixes 0day in Network Storage Devices

Summary: Zyxel released a patch on Feb. 24, 2020 for CVE-2020-9054, a critical flaw in more than a dozen NAS models that lets an attacker take remote control by injecting just two characters into the login username field, 12 days after KrebsOnSecurity alerted the company that exploit code was being sold for $20,000 by a seller known as 500mhz. Zyxel did not respond until DHS and CERT/CC were contacted, many affected models are no longer supported and will not be patched, and CERT rated the flaw a 10, its most severe.
Bottom line: Holden said ransomware operators were testing the exploit for use with Emotet, and at a $20,000 price a gang could recover the cost by compromising a single target - while owners of unsupported NAS units are told only not to expose them to the internet.

Read the original at Krebs on Security ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2020-9054
Related: New Mirai Variant Targets Zyxel Network-Attached Storage Devices Cyber Risks ·
CVE-2020-9054: Zyxel Multiple NAS Devices OS Command Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022
Threat Source newsletter (April 2, 2020) Cyber Risks ·